PaperlayerView exact revision on arXiv

Source-linked AI summary

REMARK-LLM: A Robust and Efficient Watermarking Framework for Generative Large Language Models

Ruisi Zhang, Shehzeen Samarah Hussain, Paarth Neekhara, Farinaz Koushanfar

arXiv:2310.12362v2cs.CRcs.CL

TL;DR

LLM-generated content can be exploited for spam and plagiarism, motivating ways to trace its source and claim ownership. REMARK-LLM combines learned signature encoding, reparameterization, decoding, and beam search; evaluations report higher signature capacity alongside semantic preservation, transferability, and resilience to attacks.

  • Problem

    LLM-generated text can be used for spam and plagiarism, while text watermarking must preserve semantics despite sensitivity to alterations and detection or removal attacks.

    Source: §1 · pp. 1–2

  • Method

    REMARK-LLM jointly trains message encoding, reparameterization, and message decoding, with optimized beam search for coherent watermarked text generation.

    Source: §1 · p. 2, §4.1 · p. 4

  • Results

    REMARK-LLM embeds 2× more signatures than AWT within 1.5 seconds, reports average BERT score 0.90 and average AUC 0.85, and transfers to unseen sources without extra fine-tuning.

    Source: §1 · p. 2

  • Takeaways & Limitations

    REMARK-LLM can embed up to 64 binary bits in 640-token texts without compromising semantics and coherence, with transferability to unseen data sources and LLM architectures without additional fine-tuning.

    Source: §6 · p. 14

    The conclusion leaves transfer to code and medical data, and adaptive document-level verification, for future work.

    Source: §6 · p. 14

Abstract

from arXiv · show

We present REMARK-LLM, a novel efficient, and robust watermarking framework designed for texts generated by large language models (LLMs). Synthesizing human-like content using LLMs necessitates vast computational resources and extensive datasets, encapsulating critical intellectual property (IP). However, the generated content is prone to malicious exploitation, including spamming and plagiarism. To address the challenges, REMARK-LLM proposes three new components: (i) a learning-based message encoding module to infuse binary signatures into LLM-generated texts; (ii) a reparameterization module to transform the dense distributions from the message encoding to the sparse distribution of the watermarked textual tokens; (iii) a decoding module dedicated for signature extraction; Furthermore, we introduce an optimized beam search algorithm to guarantee the coherence and consistency of the generated content. REMARK-LLM is rigorously trained to encourage the preservation of semantic integrity in watermarked content, while ensuring effective watermark retrieval. Extensive evaluations on multiple unseen datasets highlight REMARK-LLM proficiency and transferability in inserting 2 times more signature bits into the same texts when compared to prior art, all while maintaining semantic integrity. Furthermore, REMARK-LLM exhibits better resilience against a spectrum of watermark detection and removal attacks.

1 Introduction

LLM-generated text can be exploited for spam and plagiarism, while watermarking faces trade-offs among semantic fidelity, capacity, and robustness. REMARK-LLM combines learned signature encoding, reparameterization, decoding, and optimized beam search; reported evaluations show greater capacity, semantic preservation, transferability, and attack resilience.

1 Introduction

  • Spam and plagiarism risks motivate mechanisms to claim ownership of LLM-generated text and trace content distribution.Watermark signatures can support ownership validation and source tracing.Source: §1 · p. 1
  • Rule-based watermarks can be statistically removed, inference-time green-list decoding can distort semantics, and neural watermarking has limited signature length per token segment.These approaches represent distinct trade-offs in watermark insertion and preservation.Source: §1 · p. 1
  • Text watermarking is constrained by sparse insertion opportunities and sensitivity to small changes, and must withstand detection and removal attacks.Unlike minor image perturbations, textual alterations may compromise semiotic fidelity.Source: §1 · pp. 1–2
  • REMARK-LLM encodes text and signatures in latent features, uses Gumbel-Softmax [14] to produce sparse token distributions, and decodes signatures with a transformer.It incorporates text addition, deletion, and substitution transformations during training; optimized beam search supports coherent text generation and signature extraction.Source: §1 · p. 2
  • REMARK-LLM embeds 2× more signatures than AWT within 1.5 seconds, with average BERT score 0.90 and average AUC 0.85.The authors also report transferability to unseen sources without extra fine-tuning.Source: §1 · p. 2

2 Background and Related Work

Text watermarking approaches differ in how they insert signatures and in their trade-offs across effectiveness, fidelity, efficiency, and robustness. REMARK-LLM is presented as extending neural watermarking capacity while maintaining semantics and coherence.

2.1 LLM Watermarking

  • Rule-based approaches alter linguistic features, lexical properties, or synonyms; inference-time approaches restrict decoding to green-list tokens, while neural approaches encode and decode signatures through learned networks.The cited neural approach AWT is limited in embeddable signature length.Source: §2.1 · pp. 2–3

2.2 Comparison

  • The comparison criteria include effectiveness, fidelity, efficiency, robustness, and undetectability; CATER risks signature removal, KGW [18] can reduce fidelity, and EXP [19] trades efficiency for semantic preservation.The paper frames REMARK-LLM as combining neural watermarking properties while increasing capacity.Source: §2.2 · p. 3
  • REMARK-LLM embeds up to 2× longer signature sequences than the best prior art without compromising textual semantics and coherence.Table 1 is identified as a comparison of post-hoc LLM-generated text watermarking schemes.Source: §2.2 · p. 3, Table 1 · p. 3

3 Problem Formulation

REMARK-LLM frames watermarking as a way for LLM proprietors to trace generated text and claim ownership. The problem formulation highlights text-specific embedding challenges and an end-user adversary who attempts to remove signatures without distorting meaning.

3.1 Watermarking Objective

  • The cloud API watermarks responses to user prompts, and the proprietor verifies ownership by comparing decoded signatures with inserted watermarks.This workflow is presented as a tool for tracing malicious use and proving whether text is machine-generated.Source: §3.1 · p. 3, Figure 1 · p. 4
  • Proposed applications include identifying AI-generated student work, protecting LLM owners’ copyrights, and monitoring potentially misleading AI-generated content.The examples cover education, copyright protection, and misinformation monitoring.Source: §3.1 · pp. 3–4

3.2 Challenges

  • Text watermarking faces sparse insertion locations, high sensitivity to alterations, and vulnerability to rephrasing or editing attacks.The passage contrasts GPT-4’s 8.2k-token limit with over 65,000 potential watermark positions in a 256×256 image.Source: §3.2 · p. 4

3.3 Threat Model

  • The assumed adversary is an end-user with access to the cloud API but without access to trained watermarking models or original LLM outputs.The adversary seeks to remove or detect signatures while preserving text semantics.Source: §3.3 · p. 4
  • The threat-model setting is consistent with prior work AWT and EXP [19], which keep framework weights or hyperparameters unavailable to end-users.It also assumes attacks do not greatly compromise generated-output quality, accuracy, or readability.Source: §3.3 · p. 4
  • The threat model includes statistical or machine-learning detection, random word edits, NLP-model rephrasing, and re-watermarking with another framework.Text edits include random deletion, addition, or substitution; rephrasing may use models such as T5.Source: §3.3 · p. 4

4 REMARK-LLM Design

REMARK-LLM combines message encoding, reparameterization, and decoding to watermark LLM-generated text while targeting semantic fidelity and message recovery. Its insertion search balances linguistic coherence with watermark extraction, and its decoder extracts the embedded signature.

4.1 REMARK-LLM Training

  • The three-module framework encodes signatures into LLM text, sparsifies the resulting token distribution, and decodes the embedded message.Encoding combines text and message representations; reparameterization uses Gumbel-Softmax, and decoding maps the resulting distribution into embeddings for a transformer extractor.Source: §4.1 · pp. 4–5
  • Joint training minimizes semantic loss and message-recovery loss, including recovery from maliciously transformed distributions.Semantic loss compares input tokens with the watermarked distribution; message-recovery loss covers both the original and transformed distributions.Source: §4.1 · pp. 5–6

4.2 Watermark Insertion

  • Optimized beam search selects coherent watermarked text while maximizing watermark extraction accuracy across perturbed token distributions.The search evaluates candidate sentences with the message extractor; repeated iterations use different temperatures to produce more diverse outputs.Source: §4.2 · p. 6

4.3 Watermark Extraction

  • The message decoder maps the watermarked text into embedding space and extracts the predicted signature for comparison with the inserted message.The extractor produces the predicted message from the embedding representation of the watermarked text.Source: §4.1 · p. 5, §4.3 · p. 6

5 Experiments

The experiments benchmark REMARK-LLM’s effectiveness, fidelity, efficiency, robustness, and transferability across datasets and sequence lengths. Results report strong watermarking alongside semantic preservation, transfer to other LLM architectures, and lower insertion costs than inference-time baselines.

5.1 Experiments Setup

  • The experiments use HC3, Human Abstract, ChatGPT Abstract, and WikiText-2, with an 80/20 train/test split for three datasets; they assess extraction, semantic similarity, coherence, insertion time, and peak GPU memory.Robustness and undetectability evaluations are assigned to Section 5.4.Source: §5.1 · p. 7, §5.2 · p. 7

5.2.1 Segment-level Watermarking

  • With 8-bit signatures in 80-token segments, REMARK-LLM extracts more than 90% of signatures, while AWT’s WER falls to about 70%.For 4-bit signatures, REMARK-LLM’s WER drops 0.38% from WikiText-2 to Human Abstract and 0.03% from HC3 to ChatGPT Abstract; AWT’s drops are 25.65% and 12.51%, respectively.Source: §5.2.1 · p. 8, Table 3 · p. 8

5.2.2 Watermarking Long Sequences

  • At 640 tokens, KGW’s BERT-S is 35% lower than REMARK-LLM’s, while EXP’s BERT-S and BLEU-4 are 0.07 and 0.25 lower, respectively.EXP’s average z-score is 2.36 versus 7.12 for REMARK-LLM; CATER’s WER is about 50% on WikiText-2 and 13% lower than REMARK-LLM even on its best-performing dataset.Source: §5.2.2 · p. 9, Table 4 · p. 9

5.2.3 Watermarking Strength

  • At 640 tokens, REMARK-LLM achieves an average z-score of 7.12; at 8.2k tokens, it reaches 25.20 while maintaining semantic integrity.The paper reports these strengths as adequate proof for 640-token sequences and ample watermark strength for LLM proprietors.Source: §5.2.3 · p. 10, Figure 3 · p. 10

5.2.4 Watermarking Efficiency

  • For 100 samples of 80-token texts, EXP takes 14× longer than REMARK-LLM, while KGW requires nearly 2× more insertion time than REMARK-LLM and AWT.KGW and EXP require 2.1× more GPU memory than REMARK-LLM and 4.5× more than AWT; the neural approaches’ memory requirements are agnostic to LLM type.Source: §5.2.4 · p. 10, Table 5 · p. 10

5.2.5 Watermarking Integrity

  • On non-watermarked texts, REMARK-LLM’s decoding produces close to 50% WER across four test datasets, which the authors interpret as demonstrating integrity.Source: §5.2.5 · p. 10, Table 6 · p. 10

5.2.6 Watermarking Different LLM Architectures

  • After training on HC3, REMARK-LLM inserts and extracts 64-bit watermarks in 640-token outputs from OPT, OpenOrca, and LLaMA-2 while preserving semantics and coherence.The prompts do not overlap with HC3 training data, and the tested models use different architectures and training datasets.Source: §5.2.6 · p. 10, Table 8 · p. 11

5.2.7 Watermarking Examples

  • In the examples, watermarked texts remain readable and semantically similar while edits include adding, deleting, and replacing words.All displayed examples achieve 100% WER.Source: §5.2.7 · p. 11, Table 7 · p. 11

5.3 Ablation Studies

The ablations show trade-offs between watermark extraction and semantic coherence, with model scale and training and inference settings affecting performance.

5.3.1 Training-time Ablation Study

  • Larger Seq2Seq backbones improve text coherence and watermark extraction, with a substantial gain from T5-small to T5-base and a marginal gain to T5-large.The study compares T5-small, T5-base, and T5-large backbones.Source: §5.3.1 · p. 11, Table 9 · p. 11
  • Increasing masking percentage or Gumbel-Softmax temperature generally worsens coherence and increases extracted watermark bits, but at temperature 0.5, watermark extraction worsens; defaults are 50% masking and 0.3 temperature.Source: §5.3.1 · p. 12
  • A larger semantic-loss coefficient improves coherence, while a larger message-recovery coefficient improves extraction; the study sets both coefficients to 0.5.The tested coefficients range from 0.3 to 0.7 for semantic loss and 0.7 to 0.3 for message recovery.Source: §5.3.1 · p. 12, Table 11 · p. 12

5.3.2 Inference-time Ablation Study

  • As masking percentage grows, REMARK-LLM tends to achieve better WER, while lower BLEU-4 and BERT-S reflect compromised coherence and semantic preservation; inference masking is set to 50% to ensure semantic preservation and high watermark extraction rates.Source: §5.3.2 · p. 12

5.4 Attack Evaluations

Removal attacks test watermark resilience while preserving readable text; detection attacks test whether an adversary can identify watermarked content. REMARK-LLM retains extraction performance across the reported attacks, and the tested classifiers fail to distinguish watermarked from unwatermarked texts.

5.4.1 Watermark Removal Attacks

  • Removal tests use deletion, addition, synonym replacement, rephrasing, and re-watermarking; the adversary is assumed to use LLM-generated texts without extra human rewriting.The study excludes emoji or special-character attacks because they compromise readability.Source: §5.4.1 · pp. 12–13
  • Under deletion, REMARK-LLM reaches AUC 0.90; under addition, it averages AUC 0.90 and BERT-S 0.90 before attack, while AWT's addition AUC is 0.69.Figure 4 reports AUC and BERT-S for attacks on ChatGPT Abstract texts using frameworks trained on HC3.Source: Figure 4 · p. 13, §5.4.1 · p. 13
  • Under synonym replacement, REMARK-LLM maintains AUC 0.88 and BERT-S 0.90; AWT's AUC is 0.70, while KGW's BERT-S falls from 0.61 to 0.57.The replacement attack incurs a 4–5% BERT-S degradation.Source: §5.4.1 · p. 13, Figure 4 · p. 13
  • After rephrasing, REMARK-LLM maintains AUC 0.85, compared with AWT's 0.68; after re-watermarking, its AUC is 0.74, versus KGW's 0.68 and AWT's 0.61.The re-watermarking attack degrades WER for all three methods.Source: §5.4.1 · p. 13, Figure 4 · p. 13

5.4.2 Watermark Detection Attacks

  • For detection, top-word distributions remain close, and all three classifiers achieve accuracy 50% and F1-Score 0 on the test set.The test uses 500 LLM-generated and corresponding watermarked texts.Source: §5.4.2 · p. 14, Figure 5 · p. 14

5.5 Overall Evaluations

The overall evaluation compares watermarking frameworks across effectiveness, fidelity, efficiency, robustness, and undetectability. REMARK-LLM maintains good performance across these criteria, while baselines show sensitive trade-offs.

5.5 Overall Evaluations

  • Figure 6 summarizes five criteria: WER for effectiveness, BERT-S for fidelity, efficiency, average AUC after removal attacks for robustness, and undetectability.Robustness is evaluated using average AUC after removal attacks on the ChatGPT dataset.Source: §5.5 · p. 14, Figure 6 · p. 14
  • REMARK-LLM maintains good performance across the evaluation criteria, whereas the other baselines demonstrate sensitive trade-offs.The comparison is summarized in Figure 6.Source: Figure 6 · p. 14

6 Conclusion and Future Work

REMARK-LLM jointly trains modules to embed and extract signatures while maintaining semantic coherence. The authors report capacity, transferability, and resilience results, and identify broader-domain transfer and adaptive verification as future work.

6 Conclusion and Future Work

  • REMARK-LLM jointly trains message encoding, reparameterization, and message decoding to embed signatures while maintaining semantic coherence.The encoding module embeds watermarks and the decoding module extracts messages from watermarked text.Source: §6 · p. 14
  • The framework embeds up to 64 binary bits in 640-token texts without compromising semantics and coherence, and transfers to unseen data sources and LLM architectures without additional fine-tuning.The authors also report resilience against various watermark detection and removal attacks.Source: §6 · p. 14
  • Future work should explore transfer to domain-specific data such as code and medical text using additional training objectives, and adaptive verification of watermarked content.Source: §6 · p. 14

A Visualization Examples

REMARK-LLM’s examples are reported as fluent and semantically faithful, with all shown watermarks successfully extracted. A PCA visualization places watermarked and original texts close together while showing different distribution patterns.

A Visualization Examples

  • Figure 8 compares original and watermarked text visualizations for examples corresponding to Table 7.The examples are plotted after text embeddings are reduced to two dimensions with PCA.Source: A Visualization Examples · p. 17
  • All watermarks in the additional examples were successfully extracted, and the watermarked texts were fluent and preserved the originals’ semantics.The examples span ChatGPT abstracts, human abstracts, HC3, WikiText-2, and instructed LLaMA-2-generated Alpaca texts.Source: A Visualization Examples · p. 17
  • The watermarked and original texts lie close together in the feature embedding space, while their different distribution patterns support message-bit prediction.The embeddings were reduced to two dimensions using PCA; the authors interpret their proximity as showing that the watermarks do not alter meaning.Source: A Visualization Examples · p. 17

B Experimental Setups

The section documents REMARK-LLM’s implementation, architecture, training, and inference settings. It also identifies the example and visualization materials used to illustrate outputs.

Experimental Setups

  • The implementation uses PyTorch 1.9.0, Hugging Face transformer models, NVIDIA RTX A6000 GPUs, Ubuntu 20.04.5 LTS, and AMD Ryzen Threadripper 3990X processors.The setup is specified as the hardware infrastructure for training and inference.Source: B Experimental Setups · p. 17
  • The T5 model uses official pretrained Hugging Face checkpoints, while the other submodule models are trained from scratch.Table 14 lists architecture details and defines ML, TL, and ED as message length, token length, and tokenizer embedding dimension.Source: B Experimental Setups · p. 17, Table 14 · p. 17
  • Training uses an L1 loss for message recovery and cross-entropy for semantic similarity; text transformations are sampled as replacement, deletion, or addition attacks with probabilities of 33%, 33%, and 34%.The prose reports both message-recovery and semantic losses converging in the training curve, while Figure 7’s caption describes segment-level training on HC3 with 8-bit and 16-bit messages.Source: B Experimental Setups · p. 17, Figure 7 · p. 17
  • At inference, optimized beam search uses Table 15 hyperparameters, selects texts with the highest watermark extraction accuracy, and extracts signatures through Re and extractor E.Re maps the one-hot token distribution to the embedding space before extraction.Source: B Experimental Setups · p. 17, Table 15 · p. 17
  • Table 16 presents additional watermarked examples, while Figure 8 visualizes original and watermarked texts for examples corresponding to Table 7.Table 16’s first six examples are sampled from four datasets, and its last three are instructed LLaMA-2 outputs from Alpaca datasets.Source: Table 16 · p. 18, Figure 8 · p. 18

Related papers

Loading 2310.12362v2…